Helm chart for kuberex #12

New issue

Closed

opened 2026-10-31 16:37:40 +00:00 by mikluko · 1 comment

mikluko commented

2026-10-31 16:37:40 +00:00

Owner

Map: #1

Question

Write the Helm chart for kuberex in this repo (chart/) and publish it as an OCI chart next to the image (sarak.sh/mikluko/kuberex), released with the image. Rex and Claude Code are in the image, so the pod is plain:

Deployment (Recreate, one replica), one container running kuberex run, non-root (999), read-only root filesystem, all capabilities dropped, seccomp RuntimeDefault.
Values: node selector and tolerations, resources, hostPath (or any volume) for /var/lib/rex, the tailnet settings (TS_HOSTNAME, join-key Secret, TS_CONTROL_URL), ServiceAccount name, a CiliumNetworkPolicy toggle for egress.

Resolved when the chart renders and passes kubeconform -strict and helm lint, and the release workflow pushes it.

Map: #1 ## Question Write the Helm chart for kuberex in this repo (`chart/`) and publish it as an OCI chart next to the image (`sarak.sh/mikluko/kuberex`), released with the image. Rex and Claude Code are in the image, so the pod is plain: - Deployment (`Recreate`, one replica), one container running `kuberex run`, non-root (999), read-only root filesystem, all capabilities dropped, seccomp `RuntimeDefault`. - Values: node selector and tolerations, resources, hostPath (or any volume) for `/var/lib/rex`, the tailnet settings (`TS_HOSTNAME`, join-key Secret, `TS_CONTROL_URL`), ServiceAccount name, a CiliumNetworkPolicy toggle for egress. Resolved when the chart renders and passes `kubeconform -strict` and `helm lint`, and the release workflow pushes it.

mikluko added the

wayfinder:task

label

2026-10-31 16:37:56 +00:00

mikluko added a new dependency

2026-10-31 16:37:56 +00:00

#7 Image: Debian base, multi-arch, Rex and Claude Code pinned in the image

mikluko added a new dependency

2026-10-31 16:37:56 +00:00

#8 Deploy kuberex on saraksh via Flux HelmRelease

mikluko referenced this issue

2026-10-31 16:37:57 +00:00

Image: Debian base, multi-arch, Rex and Claude Code pinned in the image #7

mikluko self-assigned this

2026-11-02 20:11:03 +00:00

mikluko referenced this issue

2026-11-02 20:15:35 +00:00

kuberex 0.4.0: Helm chart, released with the image #15

mikluko referenced this issue from a commit

2026-11-02 20:19:12 +00:00

kuberex 0.4.0: Helm chart, released with the image (#15)

mikluko commented

2026-11-02 20:20:52 +00:00

Author

Owner

Answer

Chart oci://sarak.sh/mikluko/charts/kuberex (chart/ in this repo), released with the image at the same version; 0.4.0 is published (merged in PR 15).

One Deployment, one replica, Recreate; uid/gid 999, fsGroup 999, read-only root, all capabilities dropped, seccomp RuntimeDefault; /run/rex and /tmp are emptyDirs.
stateVolume: volume source of /var/lib/rex, rendered as given (hostPath, persistentVolumeClaim, ...); emptyDir when empty.
tailscale.hostname, tailscale.controlURL, tailscale.authKey.existingSecret / .key (mounted as TS_AUTHKEY_FILE).
serviceAccount.create / .name (default: release name) / .automountToken (default false).
networkPolicy.enabled: CiliumNetworkPolicy, egress to kube-dns, kube-apiserver and world only.
nodeSelector, tolerations, affinity, resources, env, podLabels, podAnnotations, imagePullSecrets.
OCI path is charts/ and not next to the image: a chart named kuberex there would take the image's own reference.
Test workflow: helm lint --strict and kubeconform -strict (Cilium CRD schema included) over chart/ci/*.yaml.

## Answer Chart `oci://sarak.sh/mikluko/charts/kuberex` (`chart/` in this repo), released with the image at the same version; 0.4.0 is published (merged in [PR 15](https://sarak.sh/mikluko/kuberex/pulls/15)). - One Deployment, one replica, `Recreate`; uid/gid 999, `fsGroup` 999, read-only root, all capabilities dropped, seccomp `RuntimeDefault`; `/run/rex` and `/tmp` are emptyDirs. - `stateVolume`: volume source of `/var/lib/rex`, rendered as given (`hostPath`, `persistentVolumeClaim`, ...); emptyDir when empty. - `tailscale.hostname`, `tailscale.controlURL`, `tailscale.authKey.existingSecret` / `.key` (mounted as `TS_AUTHKEY_FILE`). - `serviceAccount.create` / `.name` (default: release name) / `.automountToken` (default false). - `networkPolicy.enabled`: CiliumNetworkPolicy, egress to kube-dns, kube-apiserver and `world` only. - `nodeSelector`, `tolerations`, `affinity`, `resources`, `env`, `podLabels`, `podAnnotations`, `imagePullSecrets`. - OCI path is `charts/` and not next to the image: a chart named `kuberex` there would take the image's own reference. - Test workflow: `helm lint --strict` and `kubeconform -strict` (Cilium CRD schema included) over `chart/ci/*.yaml`.

mikluko closed this issue

2026-11-02 20:20:53 +00:00

mikluko referenced this issue

2026-11-02 20:20:53 +00:00

Deploy kuberex on saraksh via Flux HelmRelease #8

mikluko referenced this issue

2026-11-02 20:20:54 +00:00

Map: Rex server on saraksh #1